Openmanage Enterprise
Monthly
Information disclosure in Dell OpenManage Enterprise versions prior to 4.8.0 stems from a cryptographic key embedded in the application and shared across installations, allowing data protected by that key to be decrypted by anyone who can read it. Exploitation requires local access to the OpenManage Enterprise host plus a low-privileged authenticated account (CVSS AV:L/PR:L), so it is not remotely reachable; the impact is rated high for confidentiality and low for integrity, with a scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory (DSA-2026-467) is the reference for the fixed 4.8.0 release.
OS command injection in Dell OpenManage Enterprise affects all versions prior to 4.8.0: a remote attacker who already holds valid low-privileged credentials on the management console can pass crafted input that reaches an operating system command without proper neutralization, resulting in arbitrary command execution with high impact to confidentiality, integrity and availability (CVSS 8.8). The authentication requirement is the main limiting factor - unauthenticated exploitation is not indicated - but no user interaction is needed and attack complexity is low, so any environment where low-privilege accounts exist or can be obtained carries realistic risk. No public exploit code or confirmed active exploitation is identified at time of analysis; Dell's DSA-2026-467 advisory provides the fix in 4.8.0 and this is assessed as a near-term 'this week' priority rather than an emergency.
Authentication bypass by spoofing in Dell OpenManage Enterprise versions prior to 4.8.0 lets an unauthenticated attacker who has adjacent network access hijack existing user sessions, scoring CVSS 3.1 base 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). The attack is low in complexity and needs no credentials or user interaction, but it is bounded to attackers positioned on the same local or management network segment as the OpenManage Enterprise console rather than the open internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's stated complete fix is upgrading to version 4.8.0 or later.
Improper input validation in Dell OpenManage Enterprise versions prior to 4.8.0 allows an attacker who holds a low-privileged account and sits on an adjacent network to the appliance console to achieve code execution with high confidentiality and integrity impact. The CVSS vector (AV:A/AC:L/PR:L/UI:N) means the attacker must already be on the same management segment and authenticated at a low privilege level, but needs no user interaction and faces low attack complexity once those prerequisites are met. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Dell has released a fixed build (4.8.0 and later), so the practical risk is concentrated in unpatched management VLANs that permit low-privileged logins.
SQL injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows an authenticated, low-privileged remote user to influence SQL queries and access confidential data; the assessed impact is high confidentiality loss with no integrity or availability impact. No public exploit code or active exploitation is identified in the supplied intelligence, and Dell has released the fix in version 4.8.0 or later. The vulnerability is tracked with a this_week priority label.
Improper neutralization of argument delimiters (CWE-88 argument injection) in Dell OpenManage Enterprise consoles running any version prior to 4.8.0 allows a remote attacker who already holds a high-privileged account to inject command arguments and escalate privileges on the appliance. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring a privileged foothold, which is the primary limiting factor and confines realistic exploitation to privileged insiders or attackers who have already compromised such an account. No public exploit code has been identified at time of analysis, and the issue is tracked for remediation this week rather than as an emergency; Dell has published a security update for the product, with 4.8.0 as the fixed release.
OS command injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows a remote, high-privileged authenticated attacker to execute arbitrary operating-system commands, with high confidentiality, integrity, and availability impact. Exploitation requires an administrative account reachable over the network; no public exploit was identified at time of analysis. Dell has released 4.8.0 as the fixed version, and the high-privilege prerequisite keeps this a conditional priority rather than an internet-scale emergency.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.8.0 is a genuine but not emergency-level priority: a low-privileged attacker who already has local access and an authenticated account on the OME host can raise their privileges to high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local access plus a pre-existing low-privileged account, not remote or unauthenticated access. No public exploit identified at time of analysis, and the vendor has released a fix in version 4.8.0.
OS command injection (CWE-78) in Dell OpenManage Enterprise affects all releases prior to 4.8.0 and lets a remote attacker who already holds high-privileged, administrative access to the management console execute arbitrary operating-system commands, with high impact on confidentiality, integrity and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The hard prerequisite of existing admin-level access or valid high-privilege credentials sharply narrows realistic exploitation to insiders, credential-theft scenarios, or chaining from a separate authentication bypass rather than an unauthenticated remote attack. No public exploit was identified at time of analysis, and Dell has released a fixed version (4.8.0); the vendor-reported issue carries a this_week remediation priority.
OS command injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets a remote, low-privileged authenticated attacker execute arbitrary operating-system commands, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network access, low privileges, and no user interaction, with the affected appliance required to be network-reachable. A vendor patch to 4.8.0 is available, no public exploit was identified at time of analysis, and the this_week priority reflects a credible, actionable issue rather than an inflated high-CVSS artifact.
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Dell OpenManage Enterprise deployments running any version prior to 4.8.0 contain an improper resource-locking flaw (CWE-413) that lets an attacker who already holds high privileges on the local host bypass a protection mechanism, with the dominant impact being availability loss and a limited integrity effect. The vulnerability is not remotely reachable and cannot be triggered by an unprivileged user: the CVSS vector requires local access, high privileges, and high attack complexity, which is why it scores only 4.7 despite the availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the trigger condition involving the mishandled lock is not described in the available sources, and Dell has published a fixed release in version 4.8.0.
Incorrect permission assignment in Dell OpenManage Enterprise versions prior to 4.8.0 lets a locally authenticated low-privileged user bypass a protection mechanism and access critical resources with high confidentiality impact, while integrity and availability are unaffected. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so exploitation requires local access and pre-existing low-level privileges and is not remotely reachable over the network. No public exploit was identified at time of analysis, and the CVE is not identified as actively exploited in CISA KEV.
Dell OpenManage Enterprise versions prior to 4.8.0 leave a critical function without an authentication check, letting an unauthenticated attacker with adjacent-network access trigger server-side request forgery; CVSS 3.1 scores this 5.4 with low integrity and availability impact and no confidentiality impact. Dell's advisory identifies 4.8.0 as the fixed release, and this is a moderate-severity, context-limited issue rather than an urgent emergency because the assessed vector requires AV:A adjacency. No public exploit identified at time of analysis.
Script injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets a high-privileged attacker positioned on an adjacent network inject special elements into output that is later consumed by a downstream component, potentially executing script in that context. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.8) requires the attacker to already hold high administrative privileges on the appliance and to be reachable over an adjacent network segment, so exposure is effectively confined to insiders or actors who have already compromised the management plane; no public exploit code was identified at time of analysis and there is no CISA KEV entry. Upgrade to 4.8.0 or later to remove the exposure.
Dell OpenManage Enterprise releases before 4.8.0 fail to sufficiently restrict excessive authentication attempts (CWE-307), allowing an unauthenticated attacker on the adjacent network to trigger authentication-related behavior that the description links to phishing attacks; the assigned CVSS is 5.4 with low confidentiality and integrity impact. The vendor has released 4.8.0 as the fix, and the supplied intelligence gives this a this_month priority rather than an emergency designation. No CISA KEV confirmation is present and no public exploit identified at time of analysis.
Dell OpenManage Enterprise versions before 4.8.0 leave credentials insufficiently protected, enabling a remote attacker who already holds a low-privileged console account to obtain limited confidential information. The issue is network-reachable, requires authentication (PR:L), needs no user interaction, and has no integrity or availability impact. Dell has released an update, the priority is this_month, and no public exploit was identified in the provided intelligence at time of analysis.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a server-side request forgery flaw (CWE-918) that a high-privileged, authenticated remote user could use to make the appliance issue requests on their behalf, resulting in limited information exposure. The CVSS base score is only 2.7 (Low) with confidentiality impact limited to Low and no integrity or availability effect, and exploitation requires an administrator-level account, so an attacker must already hold trusted credentials. No public exploit code, PoC reference, or CISA KEV entry is associated with this CVE, and the vendor priority label for it is monitor.
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.
Path traversal in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote low-privileged attacker to read files outside the intended directory scope, resulting in information exposure. The vulnerability is classified under CWE-22 and carries a CVSS 3.1 base score of 6.5 (Medium), with high confidentiality impact and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remote code execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Information disclosure in Dell OpenManage Enterprise versions prior to 4.8.0 stems from a cryptographic key embedded in the application and shared across installations, allowing data protected by that key to be decrypted by anyone who can read it. Exploitation requires local access to the OpenManage Enterprise host plus a low-privileged authenticated account (CVSS AV:L/PR:L), so it is not remotely reachable; the impact is rated high for confidentiality and low for integrity, with a scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor advisory (DSA-2026-467) is the reference for the fixed 4.8.0 release.
OS command injection in Dell OpenManage Enterprise affects all versions prior to 4.8.0: a remote attacker who already holds valid low-privileged credentials on the management console can pass crafted input that reaches an operating system command without proper neutralization, resulting in arbitrary command execution with high impact to confidentiality, integrity and availability (CVSS 8.8). The authentication requirement is the main limiting factor - unauthenticated exploitation is not indicated - but no user interaction is needed and attack complexity is low, so any environment where low-privilege accounts exist or can be obtained carries realistic risk. No public exploit code or confirmed active exploitation is identified at time of analysis; Dell's DSA-2026-467 advisory provides the fix in 4.8.0 and this is assessed as a near-term 'this week' priority rather than an emergency.
Authentication bypass by spoofing in Dell OpenManage Enterprise versions prior to 4.8.0 lets an unauthenticated attacker who has adjacent network access hijack existing user sessions, scoring CVSS 3.1 base 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). The attack is low in complexity and needs no credentials or user interaction, but it is bounded to attackers positioned on the same local or management network segment as the OpenManage Enterprise console rather than the open internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's stated complete fix is upgrading to version 4.8.0 or later.
Improper input validation in Dell OpenManage Enterprise versions prior to 4.8.0 allows an attacker who holds a low-privileged account and sits on an adjacent network to the appliance console to achieve code execution with high confidentiality and integrity impact. The CVSS vector (AV:A/AC:L/PR:L/UI:N) means the attacker must already be on the same management segment and authenticated at a low privilege level, but needs no user interaction and faces low attack complexity once those prerequisites are met. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Dell has released a fixed build (4.8.0 and later), so the practical risk is concentrated in unpatched management VLANs that permit low-privileged logins.
SQL injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows an authenticated, low-privileged remote user to influence SQL queries and access confidential data; the assessed impact is high confidentiality loss with no integrity or availability impact. No public exploit code or active exploitation is identified in the supplied intelligence, and Dell has released the fix in version 4.8.0 or later. The vulnerability is tracked with a this_week priority label.
Improper neutralization of argument delimiters (CWE-88 argument injection) in Dell OpenManage Enterprise consoles running any version prior to 4.8.0 allows a remote attacker who already holds a high-privileged account to inject command arguments and escalate privileges on the appliance. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity and availability impact but requiring a privileged foothold, which is the primary limiting factor and confines realistic exploitation to privileged insiders or attackers who have already compromised such an account. No public exploit code has been identified at time of analysis, and the issue is tracked for remediation this week rather than as an emergency; Dell has published a security update for the product, with 4.8.0 as the fixed release.
OS command injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows a remote, high-privileged authenticated attacker to execute arbitrary operating-system commands, with high confidentiality, integrity, and availability impact. Exploitation requires an administrative account reachable over the network; no public exploit was identified at time of analysis. Dell has released 4.8.0 as the fixed version, and the high-privilege prerequisite keeps this a conditional priority rather than an internet-scale emergency.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.8.0 is a genuine but not emergency-level priority: a low-privileged attacker who already has local access and an authenticated account on the OME host can raise their privileges to high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local access plus a pre-existing low-privileged account, not remote or unauthenticated access. No public exploit identified at time of analysis, and the vendor has released a fix in version 4.8.0.
OS command injection (CWE-78) in Dell OpenManage Enterprise affects all releases prior to 4.8.0 and lets a remote attacker who already holds high-privileged, administrative access to the management console execute arbitrary operating-system commands, with high impact on confidentiality, integrity and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The hard prerequisite of existing admin-level access or valid high-privilege credentials sharply narrows realistic exploitation to insiders, credential-theft scenarios, or chaining from a separate authentication bypass rather than an unauthenticated remote attack. No public exploit was identified at time of analysis, and Dell has released a fixed version (4.8.0); the vendor-reported issue carries a this_week remediation priority.
OS command injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets a remote, low-privileged authenticated attacker execute arbitrary operating-system commands, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network access, low privileges, and no user interaction, with the affected appliance required to be network-reachable. A vendor patch to 4.8.0 is available, no public exploit was identified at time of analysis, and the this_week priority reflects a credible, actionable issue rather than an inflated high-CVSS artifact.
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to manipulate backend database queries, with confirmed high confidentiality impact and potential for broader compromise per the vendor's own CVSS rating. The vulnerability (CWE-89) requires only a valid low-privilege account and network access to the management interface - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released version 4.7.0 as the remediated release per advisory DSA-2026-359.
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker to inject malicious SQL constructs via the platform's web interface, leading to script injection and potential full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity and no user interaction required beyond valid credentials. No public exploit has been identified at time of analysis, and EPSS places current exploitation probability at 0.29% (21st percentile), though SSVC rates the technical impact as total.
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege credentials to manipulate backend database queries, with the vendor noting this can cascade into script injection within the management interface. The CVSS vector rates impact as high across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and Dell has released a fix in version 4.7.0 per advisory DSA-2026-359.
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to execute arbitrary operating system commands on the underlying server. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is network-exploitable with low complexity, requiring only a low-privilege account - a minimal barrier in enterprise environments where many users hold valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Dell has released a patch in version 4.7.0 per advisory DSA-2026-359.
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high-privileged console credentials to elevate their access further within the platform, achieving full confidentiality, integrity, and availability impact against the management system. The root cause is improper privilege management (CWE-269), where the application fails to enforce correct privilege boundaries for existing high-privileged sessions. No public exploit or CISA KEV listing has been identified at time of analysis; Dell disclosed and patched this vulnerability via advisory DSA-2026-359.
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authenticated attacker to execute arbitrary operating system commands on the underlying host. The flaw (CWE-78) exists because user-supplied input reaches a system shell without adequate sanitization, and the CVSS vector confirms full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Dell OpenManage Enterprise deployments running any version prior to 4.8.0 contain an improper resource-locking flaw (CWE-413) that lets an attacker who already holds high privileges on the local host bypass a protection mechanism, with the dominant impact being availability loss and a limited integrity effect. The vulnerability is not remotely reachable and cannot be triggered by an unprivileged user: the CVSS vector requires local access, high privileges, and high attack complexity, which is why it scores only 4.7 despite the availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the trigger condition involving the mishandled lock is not described in the available sources, and Dell has published a fixed release in version 4.8.0.
Incorrect permission assignment in Dell OpenManage Enterprise versions prior to 4.8.0 lets a locally authenticated low-privileged user bypass a protection mechanism and access critical resources with high confidentiality impact, while integrity and availability are unaffected. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so exploitation requires local access and pre-existing low-level privileges and is not remotely reachable over the network. No public exploit was identified at time of analysis, and the CVE is not identified as actively exploited in CISA KEV.
Dell OpenManage Enterprise versions prior to 4.8.0 leave a critical function without an authentication check, letting an unauthenticated attacker with adjacent-network access trigger server-side request forgery; CVSS 3.1 scores this 5.4 with low integrity and availability impact and no confidentiality impact. Dell's advisory identifies 4.8.0 as the fixed release, and this is a moderate-severity, context-limited issue rather than an urgent emergency because the assessed vector requires AV:A adjacency. No public exploit identified at time of analysis.
Script injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets a high-privileged attacker positioned on an adjacent network inject special elements into output that is later consumed by a downstream component, potentially executing script in that context. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.8) requires the attacker to already hold high administrative privileges on the appliance and to be reachable over an adjacent network segment, so exposure is effectively confined to insiders or actors who have already compromised the management plane; no public exploit code was identified at time of analysis and there is no CISA KEV entry. Upgrade to 4.8.0 or later to remove the exposure.
Dell OpenManage Enterprise releases before 4.8.0 fail to sufficiently restrict excessive authentication attempts (CWE-307), allowing an unauthenticated attacker on the adjacent network to trigger authentication-related behavior that the description links to phishing attacks; the assigned CVSS is 5.4 with low confidentiality and integrity impact. The vendor has released 4.8.0 as the fix, and the supplied intelligence gives this a this_month priority rather than an emergency designation. No CISA KEV confirmation is present and no public exploit identified at time of analysis.
Dell OpenManage Enterprise versions before 4.8.0 leave credentials insufficiently protected, enabling a remote attacker who already holds a low-privileged console account to obtain limited confidential information. The issue is network-reachable, requires authentication (PR:L), needs no user interaction, and has no integrity or availability impact. Dell has released an update, the priority is this_month, and no public exploit was identified in the provided intelligence at time of analysis.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a server-side request forgery flaw (CWE-918) that a high-privileged, authenticated remote user could use to make the appliance issue requests on their behalf, resulting in limited information exposure. The CVSS base score is only 2.7 (Low) with confidentiality impact limited to Low and no integrity or availability effect, and exploitation requires an administrator-level account, so an attacker must already hold trusted credentials. No public exploit code, PoC reference, or CISA KEV entry is associated with this CVE, and the vendor priority label for it is monitor.
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.
Path traversal in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote low-privileged attacker to read files outside the intended directory scope, resulting in information exposure. The vulnerability is classified under CWE-22 and carries a CVSS 3.1 base score of 6.5 (Medium), with high confidentiality impact and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remote code execution vulnerability. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.